Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

6 records

Vendor: cifi Component: Starbox Clear all filters
TI-2024-07638 CVE-2024-8239 · GHSA-f25r-g5v8-v6qj

Starbox < 3.5.3 - Contributor+ Stored XSS

Priority MEDIUM 58

The Starbox WordPress plugin before 3.5.3 does not properly render social media profiles URLs in certain contexts, like the malicious user's profile or pages where the starbox shortcode is used, which may be abused by us…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00377 Published 2024-09-30 Fixed in 3.5.3 CWE-79
TI-2024-07376 CVE-2024-7955 · GHSA-p6wm-338f-gmjm

Starbox < 3.5.2 - Admin+ Stored XSS

Priority MEDIUM 55

The Starbox WordPress plugin before 3.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_ht…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00398 Published 2024-09-10 Fixed in 3.5.2 CWE-79
TI-2024-01185 CVE-2024-1273 · GHSA-jjxx-788m-fv7g

Starbox < 3.5.0 - Contributor+ Stored XSS

Priority MEDIUM 60

The Starbox WordPress plugin before 3.5.0 does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00442 Published 2024-03-11 Fixed in 3.5.0 CWE-79
TI-2023-06218 CVE-2023-6806 · GHSA-pjj6-276v-mf4j

Starbox <= 3.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Job Settings

Priority LOW 29

The Starbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Job Settings user profile fields in all versions up to, and including, 3.4.8 due to insufficient input sanitization and output escapin…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00423 Published 2024-02-20 No fix listed CWE-79
TI-2024-00231 CVE-2024-0256 · GHSA-hvwp-rfc8-3www

Starbox <= 3.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Display Name and Social Settings

Priority LOW 28

The Starbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Profile Display Name and Social Settings in all versions up to, and including, 3.4.8 due to insufficient input sanitization and output…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0032 Published 2024-02-07 No fix listed CWE-79
TI-2024-00333 CVE-2024-0366 · GHSA-q658-fh2m-cgvf

Starbox – the Author Box for Humans <= 3.4.7 - Insecure Direct Object Reference

Priority LOW 21

The Starbox – the Author Box for Humans plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.7 via the action function due to missing validation on a user contr…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00572 Published 2024-02-05 No fix listed CWE-284